CVE-2026-73313

XenForo before 2.3.13 contains a multi-factor authentication bypass in its passkey TFA provider, an incorrect authorization flaw (CWE-863) in the WebAuthn assertion step. When a user's login is pending second-factor verification, the passkey check performs a global credential lookup without validating that the matched credential belongs to that user, so any registered passkey is accepted. An attacker who already knows a target account's password can therefore sign the challenge with their own passkey and complete login as the target user, bypassing the victim's second factor on both public forum login and the admin control panel (ACP) login path. The flaw is exploitable on forums where the passkey TFA provider is enabled, and an attacker against an administrator account would gain ACP access. No confirmed in-the-wild exploitation is reported; a public proof-of-concept exists (CVSS 4.0 score 7.6, EPSS 0.4% over 30 days, not in CISA KEV).

What to do: Upgrade to XenForo 2.3.13 or later. As an interim mitigation, disable the passkey TFA provider and require an alternative second factor (e.g., TOTP), prioritizing accounts with ACP/admin access; note that exploitation requires the attacker to already possess the target account's password, so review accounts for password reuse or credential exposure.